Which of the following DITSCAP phases validates that the preceding work has produced an IS that operates in a specified computing environment?

Question

Options

• APhase 4
• BPhase 2
• CPhase 1
• DPhase 3

• B
  2% (1)
• C
  2% (1)
• D
  95% (39)

Explanation

Phase 3 (Validation) is correct because this phase verifies that all preceding work has resulted in an information system that correctly operates within its designated computing environment - it confirms the system meets all security requirements defined in the System Security Authorization Agreement (SSAA) before final accreditation decisions are made.

Why the distractors are wrong:

• Phase 1 (Definition) establishes the C&A scope and produces the SSAA - it's about planning, not validating outcomes.
• Phase 2 (Verification) checks that the evolving system is being built to comply with the SSAA during development - it's mid-process, not a final validation.
• Phase 4 (Post Accreditation) occurs after accreditation is granted and focuses on maintaining security posture over the system's lifecycle.

Memory tip: Think of DITSCAP phases as Define → Verify → Validate → Maintain. The "V" words trip people up - Verify (Phase 2) checks work in progress, while Validate (Phase 3) confirms the finished product works as intended. "Validate = 'Yes, this is the real deal'" helps lock in Phase 3.

No community discussion yet for this question.